RE: IDS, IPS or just rubbish?

["David J. Meltzer" <djm () intrusec com>]

> They kept telling me about SQL Slammer and how this solution will stop
it. 
> What utter crap. Can anyone on this list tell me of a signature-based
IDS 
> which picked Slammer up in the 2-odd hours it needed to propogate? 

Not to rehash old threads, but it was well established on focus-ids
months ago (see the "Did IDSes detect the SQL worm? Thread) that at
least ISS RealSecure, NFR, and Dragon all had pre-existing signatures
for the buffer overflow Slammer exploited and picked it up.

-Dave

-------------------
David J. Meltzer
djm () intrusec com   
CTO, Intrusec, Inc.


-------------------------------------------------------------------------------
Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the 
world's premier technical IT security event! 10 tracks, 15 training sessions, 
1,800 delegates from 30 nations including all of the top experts, from CSO's to 
"underground" security specialists.  See for yourself what the buzz is about!  
Early-bird registration ends July 3.  This event will sell out. www.blackhat.com
-------------------------------------------------------------------------------